181–190 of 283 posts
[1] U2F, authorized devices, predictive phishing protections, etc.
Earlier quoted context omitted.
> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…
Oh yeah! Freedompop actually transformed a space into a "+" (or vice versa). And this is just free internet I set up for my dad. Took us like an hour to figure that one out.
Earlier quoted context omitted.
I simply type passwords in the answers. "What is your mother's maiden name?" - "gHk899iL@"
Annoyingly,some sites have started putting limits and validations on their security question answers...
Oh, and they referred to these security questions as "2FA."
Earlier quoted context omitted.
Enforced password reset questions. There's a limited set of about 10 questions (trivial stuff like "where were you born?"), and you have to set 3 of them. About half a year ago, I was forced to do this in order to be able to log in again (I'm only occasionally using it for publishing iOS apps). What is this, Hotmail in 2005?
And the questions haven't changed in decades. It's pretty simple to figure out things like "name of high school attended", "street you grew up on", "model of first car", "mother's maiden name", etc for just about anyone who has a social media account.
Model of first car? zSuI2LR9DvDYwr04 (drop top!)
First city visited? GGSrqPB78tcJ2WB9 (what a trip!)
Street you grew up on? 1pAXzzns5owXNYiU (very quiet!)
Favorite food? oEW5AQ738bkGf6rj (it's delicious!)
High school attended? 3i5OfyNhnWD0bQVy (go Nonces!)
I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
I've since had to change my random generator to avoid 3 of a kind, which actually makes it less random/secure i believe.. pruned some branches off of the search tree.. especially since i've now told everyone ;)
Earlier quoted context omitted.
Two ways why I think E-Mails are useful at signup: - Password Recovery (this can be optional though, for my sites it usually is) - 'Legit Users', sending an email and having them confirmed through a code in them gives a bit more confidence in the user
'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…
Earlier quoted context omitted.
And the questions haven't changed in decades. It's pretty simple to figure out things like "name of high school attended", "street you grew up on", "model of first car", "mother's maiden name", etc for just about anyone who has a social media account.
Here's a sample of mine: Model of first car? zSuI2LR9DvDYwr04 ( drop top! ) First city visited? GGSrqPB78tcJ2WB9 ( what a trip! ) Street you grew up on? 1pAXzzns5owXNYiU ( very quiet! ) Favorite food? oEW5AQ738bkGf6rj ( it's delicious! ) High school attended? 3i5OfyNhnWD0bQVy ( go Nonces! )
(Love the name of the high school mascot, by the way!)
Earlier quoted context omitted.
> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...
It wouldn't really matter how good your password was in the leak/breach scenario would it?
Earlier quoted context omitted.
Here's a sample of mine: Model of first car? zSuI2LR9DvDYwr04 ( drop top! ) First city visited? GGSrqPB78tcJ2WB9 ( what a trip! ) Street you grew up on? 1pAXzzns5owXNYiU ( very quiet! ) Favorite food? oEW5AQ738bkGf6rj ( it's delicious! ) High school attended? 3i5OfyNhnWD0bQVy ( go Nonces! )
As my dad pointed out, the answers are passwords . If you restricted passwords to every possible make of car, for example, it would be incredibly weak - too little total entropy in the possible answers. (Love the name of the high school mascot, by the way!)
United Airlines does exactly this and it's hilariously insecure. The secret questions are preselected and the answers must be from their set of answers for each. There's only 8-10 choices for each (ex: Favorite music? pop / jazz / classical / etc).
> (Love the name of the high school mascot, by the way!)
There 10 types of people. Those that got that joke and ...